Ref: 8792

Section 17 Notice under the Freedom of Information Act 2000

WITHHOLDING INFORMATION

Section 40(2) – Personal Data Relating To Third Parties

The information you have requested contains both personal data and sensitive personal data. The sensitive personal data consists of personal data relating to the commission, or alleged commission, of an offence. Personal data can only be released if to do so would not contravene any of the data protection principles set out by Article 5 of the General Data Protection Regulation (GDPR).

The principle at Article 5(a) states that ‘Personal data shall be processed lawfully, fairly and in a transparent manner’

This notice applies to your request for the name and date of birth of each offender to which the data in the attached spreadsheet relates. These are referred to in this notice as “the personal data”

Fairness We believe releasing the requested personal data into the public domain could cause distress to the individuals in this case; all individuals involved in criminal prosecutions or the execution of criminal penalties have a clear and strong expectation that their personal data will be held in confidence and not be disclosed to the public unless there is good reason to do so. This expectation increases in strength as time goes on as there is rightfully higher public interest in contemporaneous cases, and this public interest will diminish over time. This is especially true of sensitive personal data as it comprises information that individuals will regard as the most private.

Lawfulness Processing shall be lawful only if and to the extent that one of the paragraphs in Art 6(1) applies. The only relevant paragraph in this case is Article 6(1)(e):

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Section 8 of the DPA 2018 sets out the following where processing is based on this paragraph: the reference in point (e) of Article 6(1) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for— (a) the administration of justice...

It may be that disclosure of material to a journalist is capable of being the performance of a task carried out in the public interest because it is arguable that the administration of justice includes the principle of open justice.

On balance we do not consider that disclosure of names or other personal data is necessary to meet the needs of the principles of open justice as the use of index numbers will be adequate to allow cases to be distinguished from each other, and therefore provide transparency regarding the satisfaction or otherwise of confiscation orders.

In addition we note that Article 21 of the GDPR raises the bar when reliance is placed on Article 6(1)(e) by providing a legal right for data subjects to ‘object’ to the processing.

Conclusion Having considered the above we are of the view that disclosure of the personal data in this case would breach the principle at GDPR Article 5(1)(a), and that it is therefore withheld under section 40 ‘personal data’ of the FoIA 2000.

Possible Disapplication of the GDPR Section 15 of the DPA 2018 and GDPR Art 85 provide a possible provision for the GDPR to be disapplied. This is where the data controller reasonably believes that the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and the controller reasonably believes that the publication of the material would be in the public interest.

In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

On balance in this case, even if there is an intention to publish, we do not consider that disclosure of names or other personal data is necessary to meet the needs of freedom of expression and information. This therefore means that disapplication of the GDPR is not appropriate in this case, and that the conclusion set out above applies.